DI
Product
discourse
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 8High 49Medium 217Low 20
Watch
Add discourse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33426 | 3.8 | Mar 20 | Discourse users can edit or synonymize hidden tags they can't see Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27152 | 3.8 | Feb 26 | DIscourse has DM communication-preference bypass when adding members Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27150 | 3.8 | Feb 26 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2023-43814 | 3.7 | Oct 16 | Discourse is an open source platform for community discussion Affected: through 3.1.1; 3.2.0 |
| CVE-2022-46168 | 3.5 | Jan 5 | Discourse is an option source discussion platform Affected: before 2.8.14; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +9 more |
| CVE-2023-45816 | 3.3 | Nov 10 | Discourse is an open source platform for community discussion Affected: before 3.1.3; before 3.2.0; 3.2.0; 3.2.0 |
| CVE-2025-24808 | 3.1 | Mar 26 | Discourse is an open-source discussion platform Affected: before 3.3.3; before 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0 |
| CVE-2025-22601 | 3.1 | Feb 4 | Discourse is an open source platform for community discussion Affected: before 3.4.0; 3.4.0; 3.4.0; 3.4.0 |
| CVE-2023-45147 | 3.1 | Oct 16 | Discourse is an open source community platform Affected: through 3.1.1; 3.2.0 |
| CVE-2023-37904 | 3.1 | Jul 28 | Discourse is an open source discussion platform Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2026-33415 | 2.7 | Mar 31 | Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-33408 | 2.7 | Mar 19 | Discourse has Improper Authorization in "Post Edits" Report For Moderators Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-33394 | 2.7 | Mar 19 | Discourse leaks PM post edits to moderators Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-28227 | 2.7 | Feb 26 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27153 | 2.7 | Feb 26 | Discourse doesn't prevent moderators from exporting user Chat DMs Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27151 | 2.7 | Feb 26 | Discourse doesn't validate destination topic when moving posts Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-26979 | 2.7 | Feb 26 | Discourse: TL4 users are able to change status of restricted topics Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2024-52589 | 2.7 | Dec 19 | Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse Affected: stable: <= 3.3.2; beta: <= 3.4.0.beta2; tests-passed: <= 3.4.0.beta2 |
| CVE-2023-28440 | 2.7 | Apr 18 | Discourse is an open source platform for community discussion Affected: before 3.0.3; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2026-72729 | 2.0 | Aug 10 | Discourse: Stored XSS in discourse-local-dates plugin Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1 |
Showing 20